All errata/c10f2/ALT-PU-2026-1646-4
ALT-PU-2026-1646-4

Package update libxml2 in branch c10f2

Version2.9.12-alt1.p10.7
Task#405919
Published2026-02-04
Max severityHIGH
Severity:

Closed issues (8)

BDU:2023-06827
MEDIUM6.5

Уязвимость функции xmlUnlinkNode (tree.c) библиотеки libxml2, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2023-10-17Modified: 2026-03-04
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2025-11749
HIGH8.1

Уязвимость функции xmlXIncludeAddNode() файла xinclude.c библиотеки libxml2, позволяющая нарушителю скомпрометировать уязвимую систему

Published: 2025-09-26Modified: 2026-03-04
CVSS 3.xHIGH 8.1
CVSS:3.x/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0MEDIUM 6.2
CVSS:2.0/AV:L/AC:H/Au:N/C:C/I:C/A:C
References
BDU:2025-11756
LOW2.5

Уязвимость библиотеки для работы с XML и HTML файлами libxml2, связанная с переполнением буфера в стеке, позволяющая нарушителю выполнить произвольный код

Published: 2025-09-26Modified: 2026-03-04
CVSS 3.xLOW 2.5
CVSS:3.x/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS 2.0LOW 1.2
CVSS:2.0/AV:L/AC:H/Au:N/C:N/I:N/A:P
References
CVE-2023-45322
MEDIUM6.5

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

Published: 2023-10-06Modified: 2025-11-03
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
CVE-2024-34459
HIGH7.5

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.

Published: 2024-05-14Modified: 2025-11-04
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
CVE-2025-6170
LOW2.5

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.

Published: 2025-06-16Modified: 2026-04-19
CVSS 3.xLOW 2.5
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
References
GHSA-353f-x4gh-cqq8
NONE

Nokogiri patches vendored libxml2 to resolve multiple CVEs

Published: 2025-07-21
References